Currently, the majority of exchanged CTI can be classified as low-level intelligence [1]} [2]} [3]}. Survey [4]}, notes that over 250 million IoC are shared cumulatively across CTI sharing platforms every day, with this figure likely increasing in recent years. From the outset, this trend of sharing large volumes of technical intelligence may appear positive. However, when framed from the perspective of a consuming organisation, the quantity of available intelligence becomes an interpretability challenge analogous to the needle in a haystack problem.
